In recent years, with the Web applications technology continuing to progress and develop, there are more and more demands development about Web application services, and then the attendant Web application security attacks are also on the rise. The technical means for cyber attacks are endless at present, but they are generally pre-detection and deal with things in the progress, the corresponding post-detection for less maintenance. In the network center, there are a large number of the server’s equipments, Web log files as part of the server detail a variety of events happening every day of equipment system, such as client access to the server request records, hacker intrusion on the site records, and so on. Therefore, in order to effectively manage the maintenance of equipment and timely reduction in the risk of attacks, analyze audit log for later inspection and maintenance of safety equipment is necessary. Based on this, mainly research and design of security audit log system based on Web application, log audit system consists of three subsystems: the subsystem of log acquisition, the subsystem of analysis engine and the subsystem log alarm. The subsystem of log acquisition uses multi-protocol analysis to collect log, and to process the corresponding log normalization and de-emphasis. The subsystem of analysis engine uses the rule base and mathematical statistics method to extract the log feature and set the appropriate statistic parameters, and then to do the comparative analysis. The subsystem log alarm is the main configuration tasks appropriate policy and issued for the audit results show interface, or generate reports and send messages to users.
